CVE-2023-48132: 
NixOS vulnerability analysis and mitigation

An issue in kosei entertainment esportsstudioLegends mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token. The vulnerability was discovered and assigned CVE-2023-48132, affecting the Line application version 13.6.1 and specifically its esportsstudioLegends mini-app component (GitHub Report).

The vulnerability is classified as an exposure of sensitive information (CWE-200) with a CVSS v3.1 base score of 5.4 (Medium). The issue occurs when the mini-app exposes its channel access token in the response of the request to 'www.l-members.me/miniapp/members_card'. The channel access token is a critical credential used for securing communication channels within Line and should be kept secret according to official documentation (GitHub Report).

The vulnerability affects any user of the esportsstudioLegends mini-app. When exploited, attackers can utilize the exposed channel access token to broadcast malicious messages through the Line platform, including potentially fraudulent information and malicious website links (GitHub Report).

The exploit requires minimal complexity as it only needs the client to have Line installed and open the esportsstudioLegends mini-app. The vulnerability can be triggered by intercepting the response from 'www.l-members.me/miniapp/members_card', which contains the exposed channel access token (GitHub Report).